A security analyst is tasked with capturing Bluetooth traffic from a specific piconet that uses frequency hopping. The analyst has an Ubertooth One and knows the master's MAC address and clock. Which approach will allow the analyst to capture the most traffic from this piconet?

Use hcitool to put the Ubertooth into promiscuous mode to capture all channels.

Use the Ubertooth in passive mode on a single channel to capture all packets.

Use the Ubertooth with the ubertooth-follow command to follow the piconet's hopping sequence.

Use Kismet to decode the frequency-hopping pattern and then capture all channels.

A security consultant is evaluating the security of a Bluetooth keyboard that uses legacy pairing. Which vulnerability is most concerning?

The PIN is transmitted in plaintext during pairing.

The keyboard does not support encryption.

The PIN is a fixed 4-digit number that can be brute-forced offline.

The keyboard is vulnerable to BlueBorne attacks.

A security analyst is investigating a potential data leak from a Bluetooth keyboard. The analyst has an Ubertooth One and wants to capture the keystrokes being transmitted to the computer. The keyboard uses Bluetooth Classic and is already paired. What is the FIRST step the analyst should take to capture this traffic?

Run kismet to passively capture all Bluetooth traffic in the area and filter for the keyboard's MAC address.

Use hcitool cc to connect to the keyboard and then use hcidump to capture the traffic on the established connection.

Use sdptool browse to enumerate the keyboard's services and identify the HID service channel for targeted capture.

Place the Ubertooth in promiscuous mode and set it to follow the frequency-hopping pattern of the keyboard's piconet.

Which of the following is an effective countermeasure against Bluetooth eavesdropping attacks?

Setting the device to non-discoverable mode

Disabling Bluetooth when not in use

Using encryption and secure pairing modes

GIAC Assessing and Auditing Wireless Networks

Domain 4Objective 1

Bluetooth Attacks GAWN Practice Questions (Page 5)

Part of the Bluetooth and BLE Security domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 21–25

21expert · hard
A security analyst is tasked with capturing Bluetooth traffic from a specific piconet that uses frequency hopping. The analyst has an Ubertooth One and knows the master's MAC address and clock. Which approach will allow the analyst to capture the most traffic from this piconet?
Select an answer first
22foundation · easy
Which tool is specifically designed to capture Bluetooth traffic using a hardware dongle?
Select an answer first
23application · medium
A security consultant is evaluating the security of a Bluetooth keyboard that uses legacy pairing. Which vulnerability is most concerning?
Select an answer first
24application · medium
A security analyst is investigating a potential data leak from a Bluetooth keyboard. The analyst has an Ubertooth One and wants to capture the keystrokes being transmitted to the computer. The keyboard uses Bluetooth Classic and is already paired. What is the FIRST step the analyst should take to capture this traffic?
Select an answer first
25foundation · easy
Which of the following is an effective countermeasure against Bluetooth eavesdropping attacks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GAWN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GAWN” is a trademark of its owner, used for identification only.

Bluetooth Attacks GAWN Practice Questions (Page 5)

Questions 21–25

A security analyst is tasked with capturing Bluetooth traffic from a specific piconet that uses frequency hopping. The analyst has an Ubertooth One and knows the master's MAC address and clock. Which approach will allow the analyst to capture the most traffic from this piconet?

Which tool is specifically designed to capture Bluetooth traffic using a hardware dongle?

A security consultant is evaluating the security of a Bluetooth keyboard that uses legacy pairing. Which vulnerability is most concerning?

Which of the following is an effective countermeasure against Bluetooth eavesdropping attacks?

Keep studying — Bluetooth and BLE Security